src: add XML output support

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/libnftables/chain.h b/include/libnftables/chain.h
index 8a5773288a30bab755662d40dc59a65aac889eca..a7f6a50d8bd015d57e4148c4225ed88ad7ab555c 100644 (file)
--- a/include/libnftables/chain.h
+++ b/include/libnftables/chain.h
@@ -41,6 +41,7 @@ void nft_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_chain
 
 enum {
        NFT_CHAIN_O_DEFAULT     = 0,
+       NFT_CHAIN_O_XML,
 };
 
 int nft_chain_snprintf(char *buf, size_t size, struct nft_chain *t, uint32_t type, uint32_t flags);

diff --git a/include/libnftables/rule.h b/include/libnftables/rule.h
index e17799af5139f86a4e6c1e566d2401810f97a2c1..50222c52893ed9a66989f51b647c3c3581d60ffd 100644 (file)
--- a/include/libnftables/rule.h
+++ b/include/libnftables/rule.h
@@ -40,6 +40,7 @@ void nft_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nft_rule *t);
 
 enum {
        NFT_RULE_O_DEFAULT      = 0,
+       NFT_RULE_O_XML,
 };
 
 int nft_rule_snprintf(char *buf, size_t size, struct nft_rule *t, uint32_t type, uint32_t flags);

diff --git a/include/libnftables/table.h b/include/libnftables/table.h
index 1977d91c49a78fd13463db91af830850ba9e2f3d..f367bb8650bd0d1f95328081dfcd30bef16178bd 100644 (file)
--- a/include/libnftables/table.h
+++ b/include/libnftables/table.h
@@ -28,6 +28,7 @@ void nft_table_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nft_table
 
 enum {
        NFT_TABLE_O_DEFAULT     = 0,
+       NFT_TABLE_O_XML,
 };
 
 int nft_table_snprintf(char *buf, size_t size, struct nft_table *t, uint32_t type, uint32_t flags);

diff --git a/src/chain.c b/src/chain.c
index e12f82ba718b264ea4ca79f64ceb2f150cf2dca7..3c83e6d3b9e706997c625248ea9d24a16de77350 100644 (file)
--- a/src/chain.c
+++ b/src/chain.c
@@ -437,8 +437,28 @@ int nft_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_chain *c)
 }
 EXPORT_SYMBOL(nft_chain_nlmsg_parse);
 
-int nft_chain_snprintf(char *buf, size_t size, struct nft_chain *c,
-                      uint32_t type, uint32_t flags)
+static int nft_chain_snprintf_xml(char *buf, size_t size, struct nft_chain *c)
+{
+       return snprintf(buf, size,
+               "<chain name=\"%s\" handle=\"%lu\""
+                       " bytes=\"%lu\" packets=\"%lu\" >\n"
+                       "\t<properties>\n"
+                               "\t\t<flags value=\"%d\" />\n"
+                               "\t\t<type value=\"%s\" />\n"
+                               "\t\t<table value=\"%s\" />\n"
+                               "\t\t<prio value=\"%d\" />\n"
+                               "\t\t<use value=\"%d\" />\n"
+                               "\t\t<hooknum value=\"%d\" />\n"
+                               "\t\t<policy value=\"%d\" />\n"
+                               "\t\t<family value=\"%d\" />\n"
+                       "\t</properties>\n"
+               "</chain>\n",
+                       c->name, c->handle, c->bytes, c->packets,
+                       c->flags, c->type, c->table, c->prio,
+                       c->use, c->hooknum, c->policy, c->family);
+}
+
+static int nft_chain_snprintf_default(char *buf, size_t size, struct nft_chain *c)
 {
        return snprintf(buf, size, "family=%u table=%s chain=%s type=%s "
                                   "hook=%u prio=%d policy=%d use=%d "
@@ -446,6 +466,20 @@ int nft_chain_snprintf(char *buf, size_t size, struct nft_chain *c,
                        c->family, c->table, c->name, c->type, c->hooknum,
                        c->prio, c->policy, c->use, c->packets, c->bytes);
 }
+
+int nft_chain_snprintf(char *buf, size_t size, struct nft_chain *c,
+                      uint32_t type, uint32_t flags)
+{
+       switch(type) {
+       case NFT_CHAIN_O_XML:
+               return nft_chain_snprintf_xml(buf, size, c);
+       case NFT_CHAIN_O_DEFAULT:
+               return nft_chain_snprintf_default(buf, size, c);
+       default:
+               break;
+       }
+       return -1;
+}
 EXPORT_SYMBOL(nft_chain_snprintf);
 
 struct nft_chain_list {

diff --git a/src/expr/bitwise.c b/src/expr/bitwise.c
index fdab8e65ea147d3b467735251bfe5a50762925ac..ac89cbaaf51106620c57b4e7d6a5c11c6b11ad8a 100644 (file)
--- a/src/expr/bitwise.c
+++ b/src/expr/bitwise.c
@@ -18,6 +18,7 @@
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nf_tables.h>
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 #include "data_reg.h"
 #include "expr_ops.h"
 
@@ -195,10 +196,43 @@ nft_rule_expr_bitwise_parse(struct nft_rule_expr *e, struct nlattr *attr)
 }
 
 static int
-nft_rule_expr_bitwise_snprintf(char *buf, size_t size, uint32_t type,
-                              uint32_t flags, struct nft_rule_expr *e)
+nft_rule_expr_bitwise_snprintf_xml(char *buf, size_t size,
+                                  struct nft_expr_bitwise *bitwise)
+{
+       int len = size, offset = 0, ret, i;
+
+       ret = snprintf(buf, len, "\t\t<sreg>%u</sreg> "
+                                       "<dreg>%u</dreg> ",
+                       bitwise->sreg, bitwise->dreg);
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       ret = snprintf(buf+offset, len, "<mask>");
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       for (i=0; i<bitwise->mask.len/sizeof(uint32_t); i++) {
+               ret = snprintf(buf+offset, len, "%.8x ",
+                               bitwise->mask.val[i]);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+       }
+
+       ret = snprintf(buf+offset, len, "</mask> <xor>");
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       for (i=0; i<bitwise->xor.len/sizeof(uint32_t); i++) {
+               ret = snprintf(buf+offset, len, "%.8x ", bitwise->xor.val[i]);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+       }
+
+       ret = snprintf(buf+offset, len, "</xor> ");
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       return offset;
+}
+
+static int
+nft_rule_expr_bitwise_snprintf_default(char *buf, size_t size,
+                                       struct nft_expr_bitwise *bitwise)
 {
-       struct nft_expr_bitwise *bitwise = (struct nft_expr_bitwise *)e->data;
        int len = size, offset = 0, ret, i;
 
        ret = snprintf(buf, len, "sreg=%u dreg=%u ",
@@ -224,6 +258,24 @@ nft_rule_expr_bitwise_snprintf(char *buf, size_t size, uint32_t type,
        return offset;
 }
 
+static int
+nft_rule_expr_bitwise_snprintf(char *buf, size_t size, uint32_t type,
+                              uint32_t flags, struct nft_rule_expr *e)
+{
+       struct nft_expr_bitwise *bitwise = (struct nft_expr_bitwise *)e->data;
+
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return nft_rule_expr_bitwise_snprintf_xml(buf, size, bitwise);
+       case NFT_RULE_O_DEFAULT:
+               return nft_rule_expr_bitwise_snprintf_default(buf, size,
+                                                             bitwise);
+       default:
+               break;
+       }
+       return -1;
+}
+
 struct expr_ops expr_ops_bitwise = {
        .name           = "bitwise",
        .alloc_len      = sizeof(struct nft_expr_bitwise),

diff --git a/src/expr/cmp.c b/src/expr/cmp.c
index 0849c495e5a5acae2866d1141edf05977b9478a5..429f02417e3ace5e2cec080e5e56ac4d1a67310d 100644 (file)
--- a/src/expr/cmp.c
+++ b/src/expr/cmp.c
@@ -19,6 +19,7 @@
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nf_tables.h>
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 #include "expr_ops.h"
 #include "data_reg.h"
 
@@ -166,10 +167,29 @@ static char *expr_cmp_str[] = {
 };
 
 static int
-nft_rule_expr_cmp_snprintf(char *buf, size_t size, uint32_t type,
-                          uint32_t flags, struct nft_rule_expr *e)
+nft_rule_expr_cmp_snprintf_xml(char *buf, size_t size, struct nft_expr_cmp *cmp)
+{
+       int len = size, offset = 0, ret, i;
+
+       ret = snprintf(buf, len, "\t\t<sreg>%u</sreg> <op>%s</op> <data>",
+                       cmp->sreg, expr_cmp_str[cmp->op]);
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       for (i=0; i<cmp->data.len/sizeof(uint32_t); i++) {
+               ret = snprintf(buf+offset, len, "%.8x ", cmp->data.val[i]);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+       }
+
+       ret = snprintf(buf+offset, len, "</data> ");
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       return offset;
+}
+
+static int
+nft_rule_expr_cmp_snprintf_default(char *buf, size_t size,
+                                  struct nft_expr_cmp *cmp)
 {
-       struct nft_expr_cmp *cmp = (struct nft_expr_cmp *)e->data;
        int len = size, offset = 0, ret, i;
 
        ret = snprintf(buf, len, "sreg=%u op=%s data=",
@@ -183,6 +203,22 @@ nft_rule_expr_cmp_snprintf(char *buf, size_t size, uint32_t type,
        return offset;
 }
 
+static int
+nft_rule_expr_cmp_snprintf(char *buf, size_t size, uint32_t type,
+                          uint32_t flags, struct nft_rule_expr *e)
+{
+       struct nft_expr_cmp *cmp = (struct nft_expr_cmp *)e->data;
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return nft_rule_expr_cmp_snprintf_xml(buf, size, cmp);
+       case NFT_RULE_O_DEFAULT:
+               return nft_rule_expr_cmp_snprintf_default(buf, size, cmp);
+       default:
+               break;
+       }
+       return -1;
+}
+
 struct expr_ops expr_ops_cmp = {
        .name           = "cmp",
        .alloc_len      = sizeof(struct nft_expr_cmp),

diff --git a/src/expr/counter.c b/src/expr/counter.c
index f0d7617b72f5c6e2f5576cea328164bf4de6f08c..d2da9bfc992017ea1cef89ff2a68fccc8a885de4 100644 (file)
--- a/src/expr/counter.c
+++ b/src/expr/counter.c
@@ -18,6 +18,7 @@
 #include "internal.h"
 #include <libmnl/libmnl.h>
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 #include "expr_ops.h"
 
 struct nft_expr_counter {
@@ -130,8 +131,17 @@ nft_rule_expr_counter_snprintf(char *buf, size_t len, uint32_t type,
 {
        struct nft_expr_counter *ctr = (struct nft_expr_counter *)e->data;
 
-       return snprintf(buf, len, "pkts=%lu bytes=%lu ",
-                       ctr->pkts, ctr->bytes);
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return snprintf(buf, len, "\t\t<pkts>%lu</pkts> <bytes>%lu</bytes> ",
+                               ctr->pkts, ctr->bytes);
+       case NFT_RULE_O_DEFAULT:
+               return snprintf(buf, len, "pkts=%lu bytes=%lu ",
+                               ctr->pkts, ctr->bytes);
+       default:
+               break;
+       }
+       return -1;
 }
 
 struct expr_ops expr_ops_counter = {

diff --git a/src/expr/immediate.c b/src/expr/immediate.c
index b5ac602cd63900ec7deeaaaeaf44a620e0adca6a..496cbfdc6e1c2f5a2ba7ef347d32817a20724675 100644 (file)
--- a/src/expr/immediate.c
+++ b/src/expr/immediate.c
@@ -18,6 +18,7 @@
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nf_tables.h>
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 #include "expr_ops.h"
 #include "data_reg.h"
 
@@ -200,8 +201,18 @@ nft_rule_expr_immediate_snprintf(char *buf, size_t len, uint32_t type,
 {
        struct nft_expr_immediate *imm = (struct nft_expr_immediate *)e->data;
 
-       return snprintf(buf, len, "dreg=%u data=%u ",
-                       imm->dreg, imm->data.val[0]);
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return snprintf(buf, len, "\t\t<dreg>%u</dreg>"
+                                         " <data>%u</data> ",
+                               imm->dreg, imm->data.val[0]);
+       case NFT_RULE_O_DEFAULT:
+               return snprintf(buf, len, "dreg=%u data=%u ",
+                               imm->dreg, imm->data.val[0]);
+       default:
+               break;
+       }
+       return -1;
 }
 
 struct expr_ops expr_ops_immediate = {

diff --git a/src/expr/lookup.c b/src/expr/lookup.c
index 8e533c4de74549bde50a93c55db5f336e0b7ad6d..550c850f282217afc403c2f992c3d4d26374fff6 100644 (file)
--- a/src/expr/lookup.c
+++ b/src/expr/lookup.c
@@ -17,6 +17,7 @@
 #include <arpa/inet.h>
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nf_tables.h>
+#include <libnftables/rule.h>
 #include <libnftables/expr.h>
 #include "data_reg.h"
 #include "expr_ops.h"
@@ -150,19 +151,48 @@ nft_rule_expr_lookup_parse(struct nft_rule_expr *e, struct nlattr *attr)
 }
 
 static int
-nft_rule_expr_lookup_snprintf(char *buf, size_t size, uint32_t type,
-                              uint32_t flags, struct nft_rule_expr *e)
+nft_rule_expr_lookup_snprintf_xml(char *buf, size_t size,
+                                 struct nft_expr_lookup *l)
+{
+       int len = size, offset = 0, ret;
+
+       ret = snprintf(buf, len, "<set>%s</set><sreg>%u</sreg><dreg>%u</dreg>\n",
+                       l->set_name, l->sreg, l->dreg);
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       return offset;
+}
+
+static int
+nft_rule_expr_lookup_snprintf_default(char *buf, size_t size,
+                                     struct nft_expr_lookup *l)
 {
-       struct nft_expr_lookup *lookup = (struct nft_expr_lookup *)e->data;
        int len = size, offset = 0, ret;
 
        ret = snprintf(buf, len, "set=%s sreg=%u dreg=%u\n",
-                       lookup->set_name, lookup->sreg, lookup->dreg);
+                       l->set_name, l->sreg, l->dreg);
        SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
        return offset;
 }
 
+static int
+nft_rule_expr_lookup_snprintf(char *buf, size_t size, uint32_t type,
+                              uint32_t flags, struct nft_rule_expr *e)
+{
+       struct nft_expr_lookup *lookup = (struct nft_expr_lookup *)e->data;
+
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return nft_rule_expr_lookup_snprintf_xml(buf, size, lookup);
+       case NFT_RULE_O_DEFAULT:
+               return nft_rule_expr_lookup_snprintf_default(buf, size, lookup);
+       default:
+               break;
+       }
+       return -1;
+}
+
 struct expr_ops expr_ops_lookup = {
        .name           = "lookup",
        .alloc_len      = sizeof(struct nft_expr_lookup),

diff --git a/src/expr/match.c b/src/expr/match.c
index 855d21004be0314fb502b818a641def85da28f8d..0c7427dac3d2cb2aa7b88e4a40707c2a69d12307 100644 (file)
--- a/src/expr/match.c
+++ b/src/expr/match.c
@@ -15,6 +15,8 @@
 #include <stdint.h>
 #include <string.h>    /* for memcpy */
 #include <arpa/inet.h>
+#include <stdlib.h>    /* bin to hex*/
+#include <math.h>      /* bin to hex*/
 
 #include <libmnl/libmnl.h>
 
@@ -23,6 +25,7 @@
 #include <linux/netfilter/x_tables.h>
 
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 
 #include "expr_ops.h"
 
@@ -183,14 +186,47 @@ static int nft_rule_expr_match_parse(struct nft_rule_expr *e, struct nlattr *att
        return 0;
 }
 
+static
+int nft_rule_exp_match_snprintf_xml(char *buf, size_t len,
+                               struct nft_expr_match *mt)
+{
+       int ret, size=len;
+       int i;
+       int offset = 0;
+       uint8_t *data = (uint8_t *)mt->data;
+
+       ret = snprintf(buf, len, "\t\t<name>%s</name> <rev>%u</rev> <info>0x",
+                               mt->name, mt->rev);
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       for (i=0; i < mt->data_len; i++) {
+               ret = snprintf(buf+offset, len, "%x", data[i] & 0xff);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+       }
+
+       ret = snprintf(buf+offset, len, "</info>" );
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       return offset;
+}
+
+
 static int
 nft_rule_expr_match_snprintf(char *buf, size_t len, uint32_t type,
                             uint32_t flags, struct nft_rule_expr *e)
 {
        struct nft_expr_match *match = (struct nft_expr_match *)e->data;
 
-       return snprintf(buf, len, "name=%s rev=%u ",
-                       match->name, match->rev);
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return nft_rule_exp_match_snprintf_xml(buf, len, match);
+       case NFT_RULE_O_DEFAULT:
+               return snprintf(buf, len, "name=%s rev=%u ",
+                               match->name, match->rev);
+       default:
+               break;
+       }
+       return -1;
 }
 
 struct expr_ops expr_ops_match = {

diff --git a/src/expr/meta.c b/src/expr/meta.c
index b7cd2013119ef7350e95985bf38d181efb667c8a..2095545298e9429520fe4ec4387a08c8df6dc230 100644 (file)
--- a/src/expr/meta.c
+++ b/src/expr/meta.c
@@ -18,6 +18,7 @@
 #include "internal.h"
 #include <libmnl/libmnl.h>
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 #include "expr_ops.h"
 
 struct nft_expr_meta {
@@ -130,7 +131,18 @@ nft_rule_expr_meta_snprintf(char *buf, size_t len, uint32_t type,
 {
        struct nft_expr_meta *meta = (struct nft_expr_meta *)e->data;
 
-       return snprintf(buf, len, "dreg=%u key=%u ", meta->dreg, meta->key);
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return snprintf(buf, len, "\t\t<dreg>%u</dreg>"
+                                         " <key>%u</key> ",
+                               meta->dreg, meta->key);
+       case NFT_RULE_O_DEFAULT:
+               return snprintf(buf, len, "dreg=%u key=%u ",
+                               meta->dreg, meta->key);
+       default:
+               break;
+       }
+       return -1;
 }
 
 struct expr_ops expr_ops_meta = {

diff --git a/src/expr/nat.c b/src/expr/nat.c
index 17f44598155dcae2e1671c5ec26e77f3384329d7..68217bda0164ec19516d641cbe4f9dfb8675eb91 100644 (file)
--- a/src/expr/nat.c
+++ b/src/expr/nat.c
@@ -18,6 +18,7 @@
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nf_tables.h>
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 #include "expr_ops.h"
 
 struct nft_expr_nat {
@@ -201,8 +202,49 @@ nft_rule_expr_nat_build(struct nlmsghdr *nlh, struct nft_rule_expr *e)
 }
 
 static int
-nft_rule_expr_nat_snprintf(char *buf, size_t size, uint32_t type,
-                          uint32_t flags, struct nft_rule_expr *e)
+nft_rule_expr_nat_snprintf_xml(char *buf, size_t size,
+                               struct nft_rule_expr *e)
+{
+       struct nft_expr_nat *nat = (struct nft_expr_nat *)e->data;
+       int len = size, offset = 0, ret = 0;
+
+       switch (nat->type) {
+       case NFT_NAT_SNAT:
+               ret = snprintf(buf, len,
+                       "\t\t<type>NFT_NAT_SNAT</type> ");
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+               break;
+       case NFT_NAT_DNAT:
+               ret = snprintf(buf, len,
+                       "\t\t<type>NFT_NAT_DNAT</type> ");
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+               break;
+       }
+
+       ret = snprintf(buf, len, "<family>%s</family> ",
+                      nat->family == AF_INET ? "AF_INET" : "AF_INET6");
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       if (e->flags & (1 << NFT_EXPR_NAT_REG_ADDR_MIN)) {
+               ret = snprintf(buf, len, "<sreg_addr_min_v4>%u</sreg_addr_min_v4>"
+                               " <sreg_addr_max_v4>%u</sreg_addr_max_v4> ",
+                              nat->sreg_addr_min, nat->sreg_addr_max);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+       }
+
+       if (e->flags & (1 << NFT_EXPR_NAT_REG_PROTO_MIN)) {
+               ret = snprintf(buf, len, "<sreg_proto_min>%u</sreg_proto_min>"
+                               " <sreg_proto_max>%u</sreg_proto_max> ",
+                      nat->sreg_proto_min, nat->sreg_proto_max);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+       }
+
+       return offset;
+}
+
+static int
+nft_rule_expr_nat_snprintf_default(char *buf, size_t size,
+                                  struct nft_rule_expr *e)
 {
        struct nft_expr_nat *nat = (struct nft_expr_nat *)e->data;
        int len = size, offset = 0, ret = 0;
@@ -210,12 +252,13 @@ nft_rule_expr_nat_snprintf(char *buf, size_t size, uint32_t type,
        switch (nat->type) {
        case NFT_NAT_SNAT:
                ret = snprintf(buf, len, "type=NFT_NAT_SNAT ");
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
                break;
        case NFT_NAT_DNAT:
                ret = snprintf(buf, len, "type=NFT_NAT_DNAT ");
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
                break;
        }
-       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
        ret = snprintf(buf, len, "family=%s ",
                       nat->family == AF_INET ? "AF_INET" : "AF_INET6");
@@ -225,20 +268,34 @@ nft_rule_expr_nat_snprintf(char *buf, size_t size, uint32_t type,
                ret = snprintf(buf, len,
                               "sreg_addr_min_v4=%u sreg_addr_max_v4=%u ",
                               nat->sreg_addr_min, nat->sreg_addr_max);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
        }
 
-       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
-
        if (e->flags & (1 << NFT_EXPR_NAT_REG_PROTO_MIN)) {
                ret = snprintf(buf, len,
                               "sreg_proto_min=%u sreg_proto_max=%u ",
                               nat->sreg_proto_min, nat->sreg_proto_max);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
        }
-       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
 
        return offset;
 }
 
+static int
+nft_rule_expr_nat_snprintf(char *buf, size_t size, uint32_t type,
+                          uint32_t flags, struct nft_rule_expr *e)
+{
+       switch (type) {
+       case NFT_RULE_O_XML:
+               return nft_rule_expr_nat_snprintf_xml(buf, size, e);
+       case NFT_RULE_O_DEFAULT:
+               return nft_rule_expr_nat_snprintf_default(buf, size, e);
+       default:
+               break;
+       }
+       return -1;
+}
+
 struct expr_ops expr_ops_nat = {
        .name           = "nat",
        .alloc_len      = sizeof(struct nft_expr_nat),

diff --git a/src/expr/payload.c b/src/expr/payload.c
index f571206994a7befac81e955f142fc2143f2c34de..33fcef1cf65c23fd371423faacbba1a275d011cd 100644 (file)
--- a/src/expr/payload.c
+++ b/src/expr/payload.c
@@ -20,6 +20,7 @@
 #include <linux/netfilter/nf_tables.h>
 
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 
 #include "expr_ops.h"
 
@@ -169,9 +170,22 @@ nft_rule_expr_payload_snprintf(char *buf, size_t len, uint32_t type,
 {
        struct nft_expr_payload *payload = (struct nft_expr_payload *)e->data;
 
-       return snprintf(buf, len, "dreg=%u base=%u offset=%u len=%u ",
-                       payload->dreg, payload->base,
-                       payload->offset, payload->len);
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return snprintf(buf, len, "\t\t<dreg>%u</dreg>"
+                                         "<base>%u</base> <offset>%u</offset>"
+                                         "<len>%u</len>",
+                               payload->dreg, payload->base,
+                                       payload->offset, payload->len);
+
+       case NFT_RULE_O_DEFAULT:
+               return snprintf(buf, len, "dreg=%u base=%u offset=%u len=%u ",
+                               payload->dreg, payload->base,
+                               payload->offset, payload->len);
+       default:
+               break;
+       }
+       return -1;
 }
 
 struct expr_ops expr_ops_payload = {

diff --git a/src/expr/target.c b/src/expr/target.c
index 1ee7379bf5623f18556feb45caf9f9dd5ae65fc2..86c9bc87ccd435a9d003f08af87dbde9bba4e4f2 100644 (file)
--- a/src/expr/target.c
+++ b/src/expr/target.c
@@ -23,6 +23,7 @@
 #include <linux/netfilter/x_tables.h>
 
 #include <libnftables/expr.h>
+#include <libnftables/rule.h>
 
 #include "expr_ops.h"
 
@@ -183,14 +184,46 @@ static int nft_rule_expr_target_parse(struct nft_rule_expr *e, struct nlattr *at
        return 0;
 }
 
+static
+int nft_rule_exp_target_snprintf_xml(char *buf, size_t len,
+                               struct nft_expr_target *tg)
+{
+       int ret, size=len;
+       int i;
+       int offset = 0;
+       uint8_t *data = (uint8_t *)tg->data;
+
+       ret = snprintf(buf, len, "\t\t<name>%s</name> <rev>%u</rev> <info>0x",
+                       tg->name, tg->rev);
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       for (i=0; i < tg->data_len; i++) {
+               ret = snprintf(buf+offset, len, "%x", data[i] & 0xff);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+       }
+
+       ret = snprintf(buf+offset, len, "</info>" );
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       return offset;
+}
+
 static int
 nft_rule_expr_target_snprintf(char *buf, size_t len, uint32_t type,
                              uint32_t flags, struct nft_rule_expr *e)
 {
        struct nft_expr_target *target = (struct nft_expr_target *)e->data;
 
-       return snprintf(buf, len, "name=%s rev=%u ",
-                       target->name, target->rev);
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return nft_rule_exp_target_snprintf_xml(buf, len, target);
+       case NFT_RULE_O_DEFAULT:
+               return snprintf(buf, len, "name=%s rev=%u ",
+                               target->name, target->rev);
+       default:
+               break;
+       }
+       return -1;
 }
 
 struct expr_ops expr_ops_target = {

diff --git a/src/rule.c b/src/rule.c
index 6c4aa4cb07f71d8d59c4bf1bc278d70de292461b..501b4f68ed895d26a001f83be47a3cd627159d7e 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -434,12 +434,42 @@ int nft_rule_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_rule *r)
 }
 EXPORT_SYMBOL(nft_rule_nlmsg_parse);
 
-int nft_rule_snprintf(char *buf, size_t size, struct nft_rule *r,
-                      uint32_t type, uint32_t flags)
+static int nft_rule_snprintf_xml(char *buf, size_t size, struct nft_rule *r,
+                                uint32_t type, uint32_t flags)
+{
+       int ret, len = size, offset = 0;
+       struct nft_rule_expr *expr;
+
+       ret = snprintf(buf, size,
+               "<rule family=\"%u\" table=\"%s\" "
+                       "chain=\"%s\" handle=\"%llu\"> ",
+                               r->family, r->table, r->chain,
+                               (unsigned long long)r->handle);
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       list_for_each_entry(expr, &r->expr_list, head) {
+               ret = snprintf(buf+offset, len,
+                               "\n\t<expr type=\"%s\">\n", expr->ops->name);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+               ret = expr->ops->snprintf(buf+offset, len, type, flags, expr);
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+               ret = snprintf(buf+offset, len, "\n\t</expr>");
+               SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       }
+       ret = snprintf(buf+offset-1, len, "\n</rule>\n ");
+       SNPRINTF_BUFFER_SIZE(ret, size, len, offset);
+
+       return ret;
+}
+
+static int nft_rule_snprintf_default(char *buf, size_t size, struct nft_rule *r, 
+                                    uint32_t type, uint32_t flags)
 {
-       int ret;
        struct nft_rule_expr *expr;
-       int len = size, offset = 0;
+       int ret, len = size, offset = 0;
 
        ret = snprintf(buf, size, "family=%u table=%s chain=%s handle=%llu "
                                  "flags=%x ",
@@ -459,6 +489,20 @@ int nft_rule_snprintf(char *buf, size_t size, struct nft_rule *r,
 
        return ret;
 }
+
+int nft_rule_snprintf(char *buf, size_t size, struct nft_rule *r,
+                      uint32_t type, uint32_t flags)
+{
+       switch(type) {
+       case NFT_RULE_O_XML:
+               return nft_rule_snprintf_xml(buf, size, r, type, flags);
+       case NFT_RULE_O_DEFAULT:
+               return nft_rule_snprintf_default(buf, size, r, type, flags);
+       default:
+               break;
+       }
+       return -1;
+}
 EXPORT_SYMBOL(nft_rule_snprintf);
 
 struct nft_rule_expr_iter {

diff --git a/src/table.c b/src/table.c
index 48e9a6a7a01c2e1fe403b5695fd534a1369070c2..eb485b23c3774e2b2fe3cdd37f19dc7c31463021 100644 (file)
--- a/src/table.c
+++ b/src/table.c
@@ -174,12 +174,37 @@ int nft_table_nlmsg_parse(const struct nlmsghdr *nlh, struct nft_table *t)
 }
 EXPORT_SYMBOL(nft_table_nlmsg_parse);
 
-int nft_table_snprintf(char *buf, size_t size, struct nft_table *t,
-                      uint32_t type, uint32_t flags)
+static int nft_table_snprintf_xml(char *buf, size_t size, struct nft_table *t)
+{
+       return snprintf(buf, size,
+                       "<table name=\"%s\" >\n"
+                               "\t<properties>\n"
+                                       "\t\t<family value=\"%u\" />\n"
+                                       "\t\t<flags value=\"%d\" table_flags=\"%d\" />\n"
+                               "\t</properties>\n"
+                       "</table>\n" ,
+                       t->name, t->family, t->flags, t->table_flags);
+}
+
+static int nft_table_snprintf_default(char *buf, size_t size, struct nft_table *t)
 {
        return snprintf(buf, size, "table=%s family=%u flags=%x\n",
                        t->name, t->family, t->table_flags);
 }
+
+int nft_table_snprintf(char *buf, size_t size, struct nft_table *t,
+                      uint32_t type, uint32_t flags)
+{
+       switch(type) {
+       case NFT_TABLE_O_XML:
+               return nft_table_snprintf_xml(buf, size, t);
+       case NFT_TABLE_O_DEFAULT:
+               return nft_table_snprintf_default(buf, size, t);
+       default:
+               break;
+       }
+       return -1;
+}
 EXPORT_SYMBOL(nft_table_snprintf);
 
 struct nft_table_list {